Technical Tip: Blocking Potentially Malicous Sources and Anonymizing Services access to a Virtual IP using Internet Service Objects

wmichael · ‎01-16-2025

Description

This article describes how to block access from potentially malicious sources of traffic and anonymizing services such as known C&C botnets, malicious servers, Tor, anonymous VPNs, and proxy servers.

Scope

FortiGate v7.2.1+.

Solution

After FortiOS v7.2.1+, it is now possible to use Internet Service objects as the source in a firewall policy.

To configure a VIP, see Virtual IP (VIP) port forwarding configuration.

In this example, port1 is the WAN interface, and port10 is the LAN interface where the server the VIP translates to is located.

Create a new firewall policy in the web GUI: Policy & Objects -> Firewall Policy -> Create New.

Set the incoming Interface to the WAN interface that the VIP is accessed from and the outgoing interface to where the VIP is located.

In the source field, select Internet Service and search for Botnet-C&C.Server, Malicious-Malicious.Server, Spam-Spamming.Server, Proxy-Proxy.Server, Tor-Exit.Node, Tor-Relay.Node, and VPN-Anonymous.VPN. These are the source addresses used in the firewall policy.

This example shows searching for the Tor and VPN objects in the GUI:

Configure the Destination field as the virtual IP. Configure the Schedule field as 'always'. Configure the Action field as 'Deny'.

Optionally, enable the 'match-vip' on the CLI and use 'all' as the destination. See VIP traffic not matching the firewall policy with an 'all' destination for more information on this setting.

Ensure this firewall policy is above the policy allowing Internet access to the VIP.

To configure the firewall policies on the CLI:

config firewall policy

edit 2

set name "Deny-to-VIP"

set srcintf "port1"

set dstintf "port10"

set action deny

set dstaddr "Web Server"

set internet-service-src enable

set internet-service-src-name "Botnet-C&C.Server" "Malicious-Malicious.Server" "Spam-Spamming.Server" "Proxy-Proxy.Server" "Tor-Exit.Node" "Tor-Relay.Node" "VPN-Anonymous.VPN"

set schedule "always"

set service "ALL"

set logtraffic all

set name "Internet-to-VIP"

set srcintf "port1"

set dstintf "port10"

set action accept

set srcaddr "all"

set dstaddr "Web Server"

set schedule "always"

set service "HTTP" "HTTPS"

This will block access to the VIP from these potentially malicious sources of traffic.